Cybersecurity

The November 3 US midterms passed without significant cyber incidents, GovTech reports. Overnight reports from the election-security information-sharing center described one office facing failed exploitation attempts, a small number facing denial-of-service attacks or heavy web traffic, brief website interruptions, misleading text messages and a handful of bomb threats; none appeared to significantly limit voting. Former CISA director Chris Krebs told NPR it was "just another Tuesday on the internet."

Washington Secretary of State Steve Hobbs confirmed a cyberattack on his office's website, KOMO reports; some pages were briefly unavailable amid bot traffic, and he said the counties' tabulators are not connected to the internet. Colorado's election-night results site went down for about 45 minutes; its vendor, SOE Software, blamed unusually high automated traffic from results-scraping services across several vendors, and the state said ballots and results were unaffected.

The biggest problems were not cyberattacks: ballot scanners rejected ballots in most of Westchester County, New York, after a late programming change, and some Pennsylvania scanners jammed.

Records released to the Electronic Frontier Foundation and other requesters under the Freedom of Information Act show the US Postal Service's internet Covert Operations Program (iCOP) monitored social media posts about protests in 2020 and 2021, with little record of oversight or legal justification, EFF says. Bulletins covered events across the political spectrum, including a planned "Million MAGA March," a Virginia gun-rights rally and counter-protest, a Save the Post Office protest and protests outside then-Postmaster General Louis DeJoy's home.

EFF sued in 2021 after Yahoo News revealed the program. The agency says it renamed the program and stopped issuing bulletins, but EFF notes the records don't say the monitoring stopped. Emails about the program were kept on an external hard drive that, officials said, someone dropped, making it unreadable; the originals had already been deleted under the retention schedule. Few documents on internal safeguards were released.

Binance has published an incident report on the theft of about $6.3 billion on October 29, which TRM Labs calls the largest cryptocurrency theft on record. According to The Register, the FBI attributed it over the weekend to TraderTraitor, a North Korean operation linked to the Lazarus Group; TRM and Chainalysis had already named the same unit.

Binance describes a months-long intrusion, not a single phishing email. In June an engineer downloaded a malicious Homebrew installer; staff caught it and replaced the device. In September a second engineer was approached on a job-hunting platform and taken through fake interviews, the last with someone posing as a CEO who asked them to download a code "assignment" that carried malware. On October 20 the attackers used that machine and an internal AI tool to reach two wallet engineers' computers, and on October 29 they used a stolen container-deployment token to launch the theft.

TRM told WIRED the wallets on at least ten blockchains were drained in about 20 minutes, after test runs on smaller wallets. Binance says it will cover all losses and has rebuilt the wallet system and the AI tool.

When Binance reopened withdrawals on Sunday, November 1, it processed $4.65 billion out and $1.01 billion in, for $3.64 billion in net outflows (about 2.1% of its $171 billion in assets), CNBC reports. Bitcoin slid about 4% on Friday, less than the 8.3% average first-day drop after past exchange hacks, per Anchorage Digital data cited by CNBC.

Cloud security firm Wiz says at least nine platforms that developers use to build and host AI apps disclosed security incidents in October, among them Fireworks AI, Lightning AI, OpenCode, Railway, Warp and, on October 30, Northflank. It later added Brev (NVIDIA), Trigger.dev and Chainstack. Wiz says no single vulnerability links them, but every public report describes attackers hunting stored environment variables, especially keys that unlock AI services. Zeabur says it will shut down after its incident.

Wiz traced two stolen enterprise keys: each was first tested with a single call, then flooded with Amazon Bedrock requests, about 2.5 million calls in all and likely over $100,000 in usage at list price, with traffic resembling resold coding-agent use. It links the keys to an LLM-resale operation.

Northflank told customers to assume every environment variable was decrypted and to rotate all secrets; users reported their AI keys being abused. It says the attack vector was contained within an hour, that it patched the Linux flaw CVE-2026-98432 across its fleet, and that a root-cause report will follow.

Overnight from November 1 to 2, refrigeration systems at supermarkets in Belgium, Ireland, Sweden, Finland, Estonia and the Netherlands were remotely tampered with, forcing stores to throw out chilled and frozen food. In one Swedish ICA store, freezers were set to 50°C, Bloomberg reports (via Claims Journal).

Carrefour Belgium said 15 of its 700 stores were affected, Delhaize confirmed an "IT incident," Ireland's Musgrave said 13 SuperValu stores were hit, and Coop Sweden confirmed a hack at seven stores. Danish manufacturer Danfoss said the incidents involved its products, as in October, when about 700 French stores had refrigeration disabled; it told Dutch broadcaster NOS that 17 Dutch facilities were affected, according to ABC News.

No group has claimed responsibility. Bloomberg notes that equipment running legacy software that can't be patched may have stayed vulnerable after October. Separately, the Pentagon is examining freezer failures at several US military facilities; no link has been shown.

Google and partners including Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI have disrupted XCPE, a botnet of more than 1.3 million Android TV boxes and other devices in over 200 countries. Google's Threat Intelligence Group says "with high confidence" that Shenzhen device maker Videostrong Technology built the backdoor into its firmware during manufacturing and sold access to criminal affiliates.

Those affiliates installed modules for ad fraud and residential-proxy services, which route other people's traffic through the owner's home connection, according to BleepingComputer. Google says it also took down command servers used by more than a dozen related malware families, cutting off at least 10 million more compromised devices, including set-top boxes, karaoke machines and telehealth hardware.

Google has cut ties with Videostrong and banned it and future affiliates from making certified Android devices. The Register notes Videostrong did not immediately respond, and that XCPE belongs to the same ecosystem as BadBox 2.0, disrupted in 2025.

Rosstat, Russia's federal statistics agency, confirmed it was hit by a cyberattack over the weekend of October 31 to November 1 but disputed its scale, The Record reports. The Belarusian Cyber Partisans and the pro-Ukrainian group Silent Crow say they spent months inside its network, then wiped servers overnight on Saturday, claiming access to about 25,000 devices and data that includes mortality records and information on Russian military casualties. Other reports put the claimed haul at 23 TB.

According to Kommersant, cited by The Record, Rosstat's main site and regional portals were defaced with a Belarusian-language warning. Rosstat said its systems detected the activity in time, that it found no evidence protected information leaked or databases were compromised, and that it is working with law enforcement.

The claims have not been independently verified; the groups say they will publish samples. The same two groups claimed the 2025 Aeroflot attack, and Russia's Supreme Court has designated both as extremist organizations.

Cisco Talos describes VOLTA, a self-deleting Windows infostealer that, after taking browser passwords, cookies, payment cards, crypto wallet phrases, chat and gaming sessions, and cloud keys, builds a profile of the victim and sends it to a large language model through OpenRouter. The prompt tells the model to act as "a forensic intelligence analyst drafting a target assessment," with sections on what the victim is worth and how weak their security habits are.

Talos says the malware uses stolen sessions to enrich the profile, for example by searching the victim's Gmail for receipts to confirm a home address and pulling food-delivery order history. Its default model is Anthropic's Claude Opus 4.6; if a response contains refusal phrases such as "I can't," it falls back to Moonshot's Kimi K2 and then Google's Gemini 2.5 Flash, which Talos reads as the author expecting guardrails.

Talos's point: the AI is not writing malware here but doing the criminal's triage, turning a raw credential dump into a prioritized dossier.

Canonical has released fixes for CVE-2026-109518, a vulnerability in APT, the package manager used by Debian, Ubuntu and their derivatives, discovered by Max Justicz. An attacker who can tamper with unencrypted HTTP traffic between a machine and its package server, or a malicious mirror, could get APT to install a package that fails signature verification. Since package scripts run as root, that means a full takeover. It is rated High (CVSS 4.0 score 7.7).

The bug needs APT to retry a failed download, which is on by default only in Ubuntu 22.04 and newer; older releases are affected only if retries were enabled. It affects every APT front end but not snaps, and using HTTPS for package sources blocks it. Fixed versions are listed for every Ubuntu release back to 14.04.

In a research post on October 27, Anthropic said an unreleased internal model, after initial prompting and with little human involvement, found vulnerabilities in Chrome, Safari, Android, Windows and Linux and chained them into working proof-of-concept exploits. One opens the Calculator on a Mac running stock Chrome seconds after a page loads; another turns off Safari's same-origin policy so a page can read data from other sites. Anthropic says it reported everything to vendors first, and that 62 Chrome bugs got CVEs and were fixed by Chrome 156.

The Hacker News notes that Google and Apple credit Anthropic and Claude for specific fixes, but how much each chain needed from people can't be checked, and the Windows bug's public record names no finder.

The Linux chain gives a remote attacker a root shell on servers running a multipath TCP listener. Anthropic ties it to CVE-2026-98432, a race condition in the kernel's IPv4 TCP code that the kernel's CVE team rates 9.8 of 10. As of October 29, Debian, Oracle, SUSE and Amazon Linux had shipped fixed kernels; Ubuntu and Red Hat had not, and Red Hat rated the flaw lower.

A group calling itself the Department of Peace says it took personnel records from the Department of Homeland Security's login system and handed them to the transparency group Distributed Denial of Secrets (DDoSecrets), which published them on Wednesday, October 28, as "Icepick." According to WIRED and NPR, the data covers more than 41,000 employees and contractors: names, work email addresses, phone numbers and office locations, plus supervisors and the internal permission groups each person belongs to.

WIRED counts more than 21,000 records from Customs and Border Protection and about 10,000 from ICE, including staff in groups that court filings tie to certified undercover operations and wiretap programs. DDoSecrets says the data came from DHS's Okta system; Okta told WIRED it has no evidence its systems were compromised. DHS said it was "aware of a potential breach" and working to protect employees.

The release's backers call it an accountability tool; a Recorded Future analyst told WIRED it could help adversaries target staff. By Thursday, Bluesky was blocking links to the dataset and a searchable site was offline after a takedown notice filed for DHS, TechCrunch reports.